Introduction
This post discusses managing
identities with Active Directory and Access Management with Microsoft Authorization Manager.
This gives a small introduction of
Active Directory components used for Identity Management and this also explains
ideal scenarios in Identity Management and Access Management.
What’s Identity Management?
Identity management is a set of
systems which manages the users, their accesses, roles etc for enterprises,
with significant implications to security and risk strategy. And it is not just
a technology discussion as much as it is a process about the role of “roles” in
enterprises — how people and applications access.
Identity management is comprised of
both technology components and business strategies and policies
The benefits of identity management
solution can be gained by consolidating identity, policy and infrastructure management
into a single centralized solution, thereby saving time and money in
administrative overhead, lowering training requirements and increasing productivity.
Since Active Directory is an integral
part of Windows infrastructure and networking, it has already become an
important and irreplaceable component within the IT environment. And many
organizations have already made investments to migrate to Active Directory and
deploy it companywide. It makes good business sense to fully leverage those investments
by extending Active Directory to other platforms, versus the cost of trying to
maintain different solutions for different platforms.
UNIX, Linux and Mac platforms are the
second largest base of systems in many large companies, so the ability of
Active Directory in integrating with these systems made it a best choice in
Enterprise Identity Management.
The solid support from Microsoft – the
largest software company in the world is also one of the main reasons to use Active
Directory. Microsoft is firmly committed to Active Directory and continues to
invest in enhancing and expanding its capabilities.
Considering these strong reasons,
Active Directory would be an excellent choice to provide centralized, cross-enterprise
directory and infrastructure services for Identity Management in enterprises.
The only demerit is that, it does not include capabilities to easily support
non-Windows client systems. However, the solution landscape has recently
changed, and there is now a way to extend the features and benefits of Active
Directory to non-Windows systems and applications. Centrify’s DirectControl
suite includes all of the necessary software to allow UNIX, Linux, Mac and Java
environments to use Active Directory as a central user identity, infrastructure
and policy engine.
And Active Directory’s highly secure,
token-based authentication, using industry standard Kerberos, can be used
across Windows, UNIX, Linux, Mac and Java platforms. This results in a single
sign-on experience that spans all Windows, UNIX and Linux systems.
Active
Directory is based on proven enterprise-ready technologies – LDAP for directory
services and Kerberos for secure authentication. Microsoft has uniquely
combined the strengths of these two technologies to best leverage the open
extensibility of LDAP and the highly secure, ticket-based authentication of
Kerberos.
For
example, a key advantage of Active Directory’s ticket-based authentication
system is that, once the user has successfully logged into a system, his or her
credentials can be used to automatically access other systems and applications
based on established security access rights.
Microsoft’s
Group Policy capability extends Active Directory beyond identity and access
management to policy and configuration management, which is crucial for meeting
regulatory requirements. Administrators have full multi-level control over
applying policies to accounts and systems through the Group Policy system.
Active
Directory is highly scalable and secure. Active Directory’s distributed model
automatically replicates information to other sites, even over slow links,
thereby ensuring both fault tolerance with automated failover and increased
performance through automated discovery of the closest Active Directory server.
Active Directory has following
advantages:
The
followings are some of the key advantages of Active Directory.
·
Centralized user and group
account management
It can store the
organizational relationships such as manager - worker relationships.
·
Full control over password
management
This
include password aging, password complexity, and forced password resetting, as
well as the ability to temporarily disable an account. Active Directory can
also easily manage hours of use for each user and computer.
·
A distributed model for
high availability, increased performance and organizational
compartmentalization
It
has the ability to manage cross domain relationships and trusts. This means
that users in each part of the organization can always access their systems,
even in the event of a server failure.
